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Enclosed please find the our correspondence with attached Abod & Caruso data breach form letter. 
This email is being forwarded on behalf of David J. Shannon. Please direct all inquiries to Mr. 
Shannon at 215.575.2615 
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May 25, 2018 


Via Email: ag.breach@ct.gov 

Attorney General George Jepsen 
Office of Attorney General 
Attn: Security Breach Notification 
55 Elm Street 
Hartford, CT 06106 

RE: Abod & Caruso, LLC 

Our File No. 04949.00125 


Dear Attorney General Jepsen: 

Pursuant to Conn. Gen. § 36a-701b, we are writing to notify you of a data security incident involving 1 
Connecticut resident. We are submitting this notification on behalf of our client, Abod & Caruso, LLC. 

Nature Of The Security Breach 

Abod & Caruso is a law firm based in Gaithersburg, Maryland. On April 2, 2018, Abod & Caruso 
became aware that a hard drive containing information on closed client files was accessed without authorization 
on that date. As a result, some of the personal information belonging to a Connecticut resident may have been 
exposed to others, including the first and last name, home address, social security number and/or alien 
registration number. 

The resident involved in this incident was forwarded a letter notifying the resident of this incident on 
May 17, 2018. A copy of the form letter is attached hereto. 

Steps Taken Relating To The Incident 

Upon discovering the incident, Abod & Caruso immediately had the device that was accessed taken off¬ 
line so that the files contained on the device could no longer be accessed. Abod & Caruso's forensic 
information technology personnel analyzed the compromised device and conducted an internal root-cause 
analysis to determine how this incident occurred and who was impacted. The analysis to date has revealed that 
unauthorized access occurred but Abod & Caruso has found no evidence that any personal information was in 
fact compromised or talcen. 
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To prevent a similar incident from happening in the futnre, Abod & Caruso engaged an independent 
computer forensic firm to ensure that its internal systems are secure. Abod & Caruso is also in the process of 
reviewing its internal policies and data management protocols and has implemented enhanced security 
measures. All employees will be retrained on cybersecurity and privacy best practices. 

Abod & Caruso has also arranged to have Experian monitor the affected individuals’ credit for one yeai 
at no cost to them through its Identity Works^'^^ credit monitoring services. 

Should you need additional information regarding this matter, please contact me. 


Very truly yours. 



DAVID J. SHANNON 


DJS;jl 

Enel. 



Abod & Caruso, LLC 


AttOHicy? ^md Counselors at Law 
18524 Office Park Drive 
Gaitliersbotg, MD 20882 
Tdcphone; (202)462-9701 
Facsinule: (202)609-9921 


DATE 

NAME 

STREET ADDRESS 
CriY, STATE and ZIP 


Dear [NAME], 

Our firm represents individuals in various legal matters. The privacy and protection of our client's, and your 
information, is a matter that we take very seriously. We are writing to inform you of a data incident at Abod & 
Caruso, LLC that may involve some of your personal Information, 


What Hatrpened i > . 

On April a, 2018, a hard drive containing information on dosed dient files was accessed without authorization. 
The device that was accessed ivas immediately taken off-line however some files contained on the device could 
haw been accessed during this brief period. If our personal information may have been in these files. 


What Information Was Involved 

Based on our investigation into this matter, we have determined that the personal information which inay Imve 
b een accessed includes first and last names, home addresses, social securitj'’ numbers and/or alien registration 
numbers. 

What We Are Doing . . 1. 

Immediately after the incident was discovered, we conducted an internal root-cause analysis to deterinme how 
this incident occurred and who ivas impacted. Our analysis to date has determined that an unauthorized access 
occurred but we have found no eiddence tliat any personal information was in fact compromised or taken. 

To prevent a similar incident from happening in the fiiture, we have engaged an independent computer forensic 
firm to ensure that oiu’ internal systems are secure. Our forensic information technology personnel analyzed the 
compromised device and immediately removed it from our computer system. We are also in the process of 
reviewing intemal policies and data management protocols and have Implemented enhanced security measures. 
All employees will be retrained on pyhersecurity and privacy best practices. 

What W6 are doing to protect informationt 

To help protect your Identity, we are offering a complimentary one-year membership of Experian's*^ 
IdentityWorks^'"’. This product provides you with superior identity detection and resolution of identity theft. To 
activate your membership and start monitoring your personal information please follow the steps below: 

* Ensure that you enroll by: August 31,2018 (Your code will not work after this date,) 

* Visit the Experian IdentltyWorks website to enroll: www.expenanidworks.coiiVBbci-edit 

* Provide your activation code; 

If you have questions about the product, need assistance with identity restoration or would like an alternative to 
enrolling In Experian IdentityWorks online, please contact Experlan's customer care team at 877.890,9332 by 
August 31, 2018, Be prepared to provide engagement number # DB06833 as proof of eliglbiilty for the identity 
restoration services by Experian. 


ADDITIONAL DETAILS REGARDING YOUR 12-MONTH EXPERIAN IDENTITYWORKS MEMBERSHIP: 



A credit card Is not required for enroHment tn Experian IdentityWorks. 

You can contact Experian iintnediately regarding any fraud issues, and have access to the following features 
once you enrol! in Experian IdentityWorks; 

“ Er^erian credit report at signup: See what information is associated with your credit file. Daily credit 
reports are available for online members only.* 

- Credit Monitoring: Actively monitors Experian file for indicators of fraud, 

« Identity Restoration: Identity Restoration agents are immediately available to help you address credit 
and non-credit related fraud. 

" Experian IdentityWorks ExtendCARE™: You receive the same high-level of Identity Restoration support 
even after your Experian IdentityWorks membership has expired, 

* Up to $1 Million Identity Theft insurance**: Provides coverage for certain costs and unauthorized 
electronic fund transfers. 


If you believe there was fraudulent use of your information and would like to discuss how you may be able to 
resolve those issues, please reach out to an Experian agent at 877.890,9332. If, after discussing your situation 
with an agent, It is determined that Identity Restoration support is needed, then an Experian Identity 
Restoration agent is available to work with you to Investigate and resolve each incident of fraud that occurred 
(including, as appropriate, helping you with contacting credit grantors to dispute charges and close accounts; 
assisting you in placing a freeze on your credit file with the three major credit bureaus; and assisting you with 
contacting government agencies to help restore your identity to its proper condition). 

Please note that this Identity Restoration support is available to you for one year from the date of this letter and 
does not require any action on your part at this time. The Terms and Conditions for this offer are located at 
WWW,ExaerianlDWorks.com/restoratlon . You will also find self-help tips and information about identity 
protection at this site. 

We sincerely apologize for this Incident and regret any Inconvenience it may cause you. Should you have 
questions or concerns regarding this matter, please do not hesitate to contact us at (202) 462-9701. 


Since rel' 



Curtis P, Abod 
Member 

Abod & Caruso, LEG 


* Offline members wIH be eligible to call for additional reports quarterly after enrolling 

++ Identity theft insurance is underwritten bytnsurance company subsWIaries orafflUates of American Internafionai Group, inc. (AlG). 
The dascriptlon herein is a summary and intended for informatlonat purposes only and does not include all terms, conditions and 
exclusions ofthe policies described. Please referto the actual policies for terms, conditions, and exclusions of coverage. Coverage may 
not be available in a 11 jurisdictions 


TTtfwKiatimi about Identity Theft PreventictB: 


We recommend that you regulaiiy review statements ftomyour accounts and periodically obtain yoiu’ credit report 
from one or more of the national creditreporting companies. Yon may obtain afreecopy ofyonr credit report online at 
■wtvrv.antiualci'editi'eport.com, by calling toU-fr'ee 1-877-322-8228, or by mailing an Annual Credit Report Request 
Form (available atwvyv,aniiua]creditreport.coin) to: AimualCredit Report Request Serace,P. 0 .80x105281, Adaula, 
GA, 30348-5281. You may also pm-chase a copy of j-our cindit report by contacting one or more of the three national 
credit reporting agencies listed below. 



Equifax; P, 0 . Box 740241, Atlanta, Georgia 30374-0241, i- 8 oo-' 685 “iiii, mvw.equifax.com 

E^erlan: P.O. Box 9532, Allen, TX 75013,1-888-397-3742, \nvnr,experiaii.cora 

Ti-ansUnion; P.O. Box 1000, Chester, PA 19022,1-800-888-4213, wviv.transunion.com 
Wlien you receiTO your credit reports, reiiefivtiieia carefully. look for accounts or creditor inquiries that you did not 
initiate or do not recognize. Look for information, such as home addi'ess and. Social Security number, tliatisnot 
accurate. Ifj^on see an3?tlung you do not undemtand, call the credit reporting agencj'' at the telephone number on tire 
report. 

We recommend you remain ligilant rvidi respect to revieiving yottt' account statements and credit reports, and 
promptly report any suspicious activify or suspected identity tlieft to the proper law enforcement autliorities, including 
local law enfor'ceinent, your state’s attorney ^neral and/or the Federal Ttade Commission (''FTC’p, You may contact 
the FTC or yottr state’s regulatory authmify to obtain additional information about avoiding identity theft. 

Federal Trade Cotoinlsslon, Consumer Response Center,600 Pennaytvania Avenue, NW, Washington, DC 
20580,1-877-IDTHEFT (438-4338), uwv.ftc.gov/idaieft 

For residents of Maryland; You may also obtain infomiation about prerenhng and avoiding identity theft fixjm 
the Maryland Office of the Attorney General: Maiyland Office «f the Attorney General, Consumer Protection 
Division 200 St. Paul Place, Baltimore, MD 21202,1-888~742-QD22. wwv.oag.Btate.md.u5 

For residents of North Carolina; You may also obtain Information aboutpreventing and avoiding Identity 
theft from the Noitli Carolbia Attorney General’s Office: North Carolina Attorney General’s Office, 
Consumer Protection Dmsion, 9001 Mail Service Center, Raleigh, NC 27699-9001,1-877-5-NO-SCAM, 
wwv.nedoi.gov 

You may rvant to order copies of your credit reports and check for any bills thatyou do not recognize, If jw! find 
anytlriug suspicious, call the credit reporting agency at the phone number on the report. Keep a copy of this notice for 
your records in case of fiiture problems rvith your records. If you are a California resident, we suggest that you visit the 
rveb site of the California Office of Privacy Protection at wvw.privacy,ca.gov to find more information about your 
privacy. 

Fraud Alerts; There are ^0 two typies of fiuud alerts that you can place on your- credit report to put jfour creditors on 
notice thatyou may be a victim of ftaud: an initial alert and an extended alert. You mayasktlrat an initial fraud alert be 
placed on yoiu* credit report if you suspect you have been, or are about to be, a rictim of identity theft An Initial fi.uud 
alert stays on your credit reportfor at least 90 days. You may have an extended alert placed on your credit report if you 
have already been a victim of identity theft rvith the appropriate docutnentaiy proof. extended fraud alert stftys on 

your credit report for 7 years. You can place a ftaud alert on your credit report by calling the toIl-fi‘ee fraud number of 
any of the three national credit reporting agencies listed below. 

Equifax: 1-888-766-0008, rvwrv.equifax,coin 

Experkn; 1-888-397-3742, wvw.expei'lan.com 

TransUnion: 1-800-680-7289, fi'aud.transunion.com 

Credit Freezes; You may have the right to put a credit freeze, also ktiorvn as a security freeze, onyour credit file, so 
that no new credit can be qpened inyour name without the use of a PIN number that is issued to you when you initiate 

afreeze. A credit freeze is designed to prevent potential credit grantors from accessing your credit report rvithout your 

consent. If you place a credit freeze, potential creditoro and other thiiriparties will not be able to get access to your 
credit report unless you temporaiily lift the freeze. Therefore, using a credit freeze ma)'-delay your ability to obtain 
credit. In addition, you may incur fees to place, lift and/or remove a credit freeze. Credit freeze laws vary from state to 
state. The cost of placing, teruporaiily lifting, and removing a credit freeze also varies by state, generally $5 to $20 per^ 
action at each credit reporting company. Gnfffee afixiud tdei% you must separately plaoa a credit freeze onyour credit 
file at each credit vepovtiny company. Since the instructions forliowto establish a credrt freeze differ ftoni state to 
state, please contact the three major credit I'eporting companies as specified below to find out more information; 

Equifex: P.O, Box 105788, Aflanta, GA 30348, wvw.equifrx.cotii 

Experian: P.O. Box 9554 ) Allen, TX 75013, wwv.experian.com 

TransITnion LLC; P.O. Box 2000, Chester, PA, 19022-2000, fieeze.transunion.com 


You can obtain more information about fraud alerts arrd credit freezes by contacting the FTC or one of the national 
credit reporting agencies listed above. 



